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The internet of things (IoT) is one of data revolution area and is the following 
extraordinary mechanical jump after the internet. In terms of IoT, it is 
expected that electronic gadgets that are used on a regular basis would be 
connected to the current of the internet. IPv6 over low-power wireless 
personal area networks (6LOWPAN) is a one of IPv6 header pressure 
technology, and accordingly, it is vulnerable to attack. The IoT is a 
combination of devices with restricted resource assets like memory, battery 
power, and computational capability. To solve this, RPL or routing protocol 
for low power Lossy network is deploy by utilizing a distance vector scheme. 
One of denial of service (Dos) attack to RPL network is blackhole attack in 
which the assailant endeavors to become a parent by drawing in a critical 
volume of traffic to it and drop all packets. In this paper, we discuss research 
on numerous attacks and current protection methods, focusing on the 
blackhole attack. There is also discussion of challenge, open research issues 


and future perspectives in RPL security. Furthermore, research on blackhole 
attacks and specific detection technique proposed in the literature is also been 
presented. 
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1. INTRODUCTION 

The internet of things (oT) was authored, in the year 1999 and officially presented by the international 
telecommunication union (ITU) in year 2005 [1]. It is expected that loT will grow to 75 billion in year 2025 
[2]. The security worry for "Things" is caused by vulnerabilities acquainted due to negligent software design; 
this allow the access of malware to the device. low-power and lossy networks (LLNs) are form by massive 
quantity of embedded networking devices that share the same power, memory, and computational resources 
[3]. loT are connected by embedded networking devices that have a predefined quantity of electricity, memory, 
and processing power. These are connected via a multiple type of interfaces and may be used for a multiple 
type of applications, including smart vehicle, health care , traffic monitoring and smart building [4]. The present 
routing methods in LLN are insufficient for dealing with the diverse communication in IoT. The internet 
engineering task force created the routing protocol (RPL) for LLNs also know as RPL to solved the LN’s 
routing issues [5]. 

Moreover, IoT networks face critical asset limits (energy, memory, and registering), and their 
correspondence lines are intrinsically high-loss and low-throughput [6]. The traffic are not determined just as 
far as a point-to-point network. The gadgets regularly interface through highlight multipoint and multipoint- 
to-point protocol [7]. Current routing technique are insufficient to solve the needs of IoT comunication. 
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Subsequently, a stack of standardised protocols created, with the IEEE 802.15.4 standard convention for the 
correspondence layers within WPANSs, including 6LowPAN, which characterise embodiment and header 
compression components for 802.15.4 and IPV6. 

RPL has grown in popularity both in industry and academics [8] due to its capacity to provide effective 
routing among resource constraints IoT nodes and adaptability in adjusting to various quality of administration 
(QoS) support and network design [9]. RPL was planned to be a direct (yet useful) and utilitarian frameworks 
organization showing control of loT networks which involves resource-constrained devices [5]. All these small 
intercommunicating gadgets are at present being utilized in an enormous display of IoT application 
organizations and used to complete any given task [10]. 

However, RPL-based networks are vulnerable to a massive security vulnerabilities due to their limited 
nature [11], [12]. The most dangerous attack in IoT implementation is the blackhole attack, which is regarded 
as one of the most dangerous and a point of entry for all other attacks [13]. Furthermore, it is also one of the 
lethal RPL attacks, initiated when a rogue node secretly loses all packets that it is intended to be transmitted 
[14], causing massive energy losses, congestion, and network overhead issues. RPL is also defenseless against 
blackhole assaults where the assaults can lead a topological separation for a sub network in a LLN. A pernicious 
inciting blackhole assault drops packet from node in its subtree which it ought to be process. Thus, the affected 
node actually segregates other nodes within the subtree from the remaining overall RPL traffic [7], [15]. 

A RPL-based network known as the 6LOWPAN network comprised of sensors and embedded devices 
that collect data and forward it to a root known as a IPv6 over low-power wireless personal area networks 
(6LOWPAN) border router (6LBR) for aggregation and processing [16]. Similar to other RPL-based networks, 
6LoWPAN networks using the RPL protocol are also vulnerable to blackhole attacks which may involve a 
node or few cooperating nodes, making the attack more difficult to be to detected [5]. When a blackhole assault 
is deployed by spreading multiple nodes in a network, it will create the distributed denial of dervices (DDoS) 
within the network [17]. Successfully concealed attacks may cause an attacked network to act very similarly 
to a healthy network and may disrupt communication and data flow between linked devices [18]. Increased 
delays in the delivery of the majority of packets to the sink, a decrease off overall packet delivery fraction, and 
increase of frequency of direction-oriented directed acyclic graph (DODAG) information object (DIO) 
messages exchanged between peers can all serve as primitive indicators, but do not constitute an exhaustive 
list of parameters sufficient to identify an attack.If the malicious node decreases its own packet sending 
behaviour to null, the packet latency and frequency of DIO messages may opera. 

In this paper, related literature discussing blackhole attacks on IoT network are studied in terms of the 
experimental setup, limitations, detection and performance measures. This paper is organized in four main 
sections. Section 2 provides the preliminary studies which is IoT architecture, IPv6 over low-power wireless 
personal area networks (6GLowPAN), routing protocol for low-power and lossy networks (RPL), RPL based 
routing attack and blackhole attack. Section 3 discuss research that have been done related to blackhole attack 
in IoT network and section 4 concluded the paper 


2. BACKGROUND 
2.1. Internet of things (IoT) architecture 

IoT allows immense quantity of extremely heterogeneous sensors or devices to be closely sensing the 
physical world and connect to the internet [19]. The architecture of IoT is composed of four main layers: the 
perception layer, the network layer, the support layer and the application layer [20], as shown in Table 1. IoT 
network layer stack is shown in Figure 1. 


Table 1. IoT architecture 


Layer Technology 
Application Layer Smart House Application, Mobile Application 
Support Later Data Analytics, Data Storage, Cloud Computing 


Network Layer Internet, Mobile Network, 2G/33G/4G Communication Network 
Perception Layer Wireless Sensor, GPS, RFID Reader 


LoWPAN use IPv6 to comply the 127 bytes of frame size for low power sensor device [21]. The distribution 
of IPV6 packet is supported at data link later while fragmentation is done at the adaptation layer. Fragmentation 
overlapping and duplication can happen due to lack of authentication in 6LowPAN. 6LOWPAN is standardized 
for the IPv6 adaptation layer, which contains data client and cross-layer which realize the usage if IPV6 
addressing protocolover LLNs [7]. 
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IoT Network Layer 


Figure 1. loT network layer stack 


Because of IoT characteristics like significant packet loss, resource constraints and slow network 
speed, cutting-edge routings like Adhoc open shortest path first (OSPF) are unsuitable for LLNs. To address 
this issue, an assortment of protocols has been devised. IEEE 802.15.4 PHY/MAC for the physical and data 
link layers, 6LOWPAN, RPL, and application layer constrained application protocol are among these 
conventions. The essential user datagram protocol layer is utilized for transport. RPL was standardized as RFC 
6550 by IETF routing over low power and lossy networks (ROLL) group in year 2015 [5], [22]. 


2.2. IPv6 over low-power wireless personal area networks (6LowPAN) 

The are numerous communication protocols are available for long and short range IoT connectivity, 
including 6LOWPAN, Wi-Fi, NB-IoT, WiMax, LTE-M, radio frequency identification (RFID), and Bluetooth 
[23]. 6LoWPan protocol is a short-range protocol, low power and optimised for personal area networks (PAN) 
and it utilize the idea of encapsulation technique and IPv6 header which suitable for loT devices [9]. bLoWPAN 
advocated the inclusion of an adaptor layer in between the network and data connection levels in the IP stack. 
6LOWPAN supports IPv6 packet fragmentation and defragmentation within IEEE 802.15.4 frames, enabling 
IPv6 head compression. In 6LoWPAN, packet transfer from a source node to receipent node is depending on 
wireless mesh network [24]. Contributions from the 6LoWPAN facilitated the establishment of an IP-based 
network of tiny devices and, as a result, the improvement of IoT applications. By specifying the routing of 
IPv6 packets in limited networks, 6LoWPAN facilitates the integration of IP-based infrastructures with WSNs. 
RPL is created as part of 6LOWPAN in order to efficiently manage the network layer activities during Internet 
connectivity. 


2.3. Routing protocol for low-power and lossy networks (RPL) 

LL LLNs has a critical limitation with accessibility of assets at node. They have restricted handling 
and memory capacities, and are controlled by batteries or a searching device. These nodes are associated 
through lossy associations that can keep up with their state at low data rates. In contrast with other routing 
protocols (e.g., Ad Hoc on-demand distance vector (AODV) and dynamic source routing (DSR)), RPL might 
give a quicker reaction time because of the route being accessible upon demand (e.g., continuously steering 
through the parent node). The results uncover that most of reactive routing protocol (for instance, AODV and 
DSR) experience the ill effects of unreasonably unique node versatility because of their low course 
intermingling and correspondence throughput. With RPL, it can moderately effectively to adjust the rate at 
which parent node is refreshed in light of the dynamism of the network [14]. 

The RPL topology, which is designed for use in distance vector routing, is built of one or more 
DODAG that are each rooted at DODAG root [25]. Each RPL network is composed of several RPL instances, 
each of which may include a DODAG [26]. The DODAG's root node may store and manage data, example the 
version number. It frequently serves as an IPv6 border router (BR) and merge LLN to the another network or 
Internet from which instructions may be obtained or data gathered processed. DODAG information object 
(DIO), DODAG information solicitation (DIS) and destination advertisement object (DAO) are type of control 
message used in RPL [27]. Nodes function through RPL in-positions, each contain of an optimization objective 
that hold on the objective of the application, later function as the objective function (OF) [28], [29]. DIO main 
function to broadcast message and involve in topology change [30]. 

Moreover, in RPL, every node selects a parent node based on a set of criteria, and this chosen parent 
acts as the node's gateway. A non-root node may join only one RPL instance, but may switch to another 
afterwards. Assuming a node decides to communicate a packet for which it doesn't have a routing table entry, 
it basically advances it to a favored parent who has a way to the objective or to its own parent for additional 
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transmission until the packet arrives at the last objective in the tree [31]. RPL sees way determination as 
significant and consequently applies an assortment of measurements to achieve this goal. Each node in the 
DODAG works out its position comparable to the DODAG root hub's (sink) position and the places of the 
other nodes. A node's position diminishes as it moves toward the DODAG root, however, increments as it 
approaches the leaf nodes. Storing and non-storing mode are supported in the RPL network and in source 
directing, data of objective is kept in each packet. This needs the DODAG root to keep a data set of data about 
each organization node. In non-storing mode away mode, in network routing table is remain to identify the 
destination of packet send by RPL nodes. 

Ns has a critical limitation with accessibility of assets at node .They have restricted handling and 
memory capacities, and are controlled by batteries or a searching device.These nodes are associated through 
lossy associations that can keep up with their state at low data rates [32]. It is every now and again unreliable 
because to the variable packet delivery speeds. In contrasted with other routing protocol (e.g., AODV and 
DSR), RPL might give a quicker reaction time because of the route being accessible upon demand (e.g., 
continuously steering through the parent node). The results uncover that most of reactive routing protocol (for 
instance, AODV and DSR) experience the ill effects of unreasonably unique node versatility because of their 
low course intermingling and correspondence throughput. With RPL, it can alter it moderately effectively to 
adjust the rate at which parent node is refreshed in light of the dynamism of the network [14]. 

The RPL topology, which is designed for use in distance vector routing, is built of one or more 
DODAG that are each rooted at DODAG root [25]. It frequently serves as an IPv6 border router (BR) and 
merge LLN to the another network or Internet from which instructions may be obtained or data gathered 
processed. DODAG information object (DIO), DODAG information solicitation (DIS) and destination 
advertisement object (DAO) are type of control message used in RPL [27]. Nodes function through RPL in- 
positions, each contain of an optimization objective that hold on the objective of the application, later function 
as the objective function (OF) [28], [29]. DIO main function to broadcast message and involve in topology 
change [30]. 

Each RPL network is composed of several RPL instances, each of which may include a DODAG [26]. 
The DODAG's root node may store and manage data, example the version number. In RPL, every node selects 
a parent node based on a set of criteria, and this chosen parent acts as the node's gateway. A non-root node may 
join only one RPL instance, but may switch to another afterwards. Assuming a node decides to communicate 
a packet for which it doesn't have a routing table entry, it basically advances it to a favored parent who has a 
way to the objective or to its own parent for additional transmission until the packet arrives at the last objective 
in the tree [31]. RPL sees way determination as significant and consequently applies an assortment of 
measurements to achieve this goal. Each node in the DODAG works out its position comparable to the DODAG 
root hub's (sink) position and the places of the other nodes. A node's position diminishes as it moves toward 
the DODAG root, however, increments as it approaches the leaf nodes. Storing and non-storing mode are 
supported in the RPL network and in source directing, data of objective is kept in each packet. This needs the 
DODAG root to keep a data set of data about each organization node. In non-storing mode away mode, in 
network routing table is remain to identify the destination of packet send by RPL nodes. 


2.4. Routing protocol for low-power and lossy networks (RPL) based routing attack 

RPL has a few self-healing mechanisms and security protections in its standard version to ensure 
optimal network operation.Confidentiality and integrity of data are built-in components of the protection 
system [28]. In authenticated mode, they enter the network only as leaves before they get a second key from 
an authority before serving as routers. In the pre-installed modes ,with pre-shared keys the nodes will join the 
network. In unsecured mode makes use of link elements to safeguard exchanges [28]. 

The ROLL gives a comprehensive understanding of the RPL's security features [33]. These security 
assaults are classed using the security model's confidentiality, integrity, authentication, and availability criteria 
(C.LA.A). Due to the complexity of RPL security, existing wired security techniques like as firewalls are 
inapplicable, and hence its nodes lack well-defined boundaries. Due to the lack of centralised management and 
node collaboration, cryptographic procedures cannot be employed to safeguard RPL routing's security. 
Additionally, because the nodes' equipment are not tamper-resistant, it easy to be expose and compromise the 
node encryption. Therefore, because of the alteration of their source code, the tested nodes will downgrade the 
output of the RPL network [34]. Figure 2 which is based on study by [35] categorised security attacks related 
to RPL as follows: i) attack on network resource, ii) attack on network topology, and iii) attack on network 
trafic. 

RPL attacks also target network topology. It may be classified into two broad categories: 
suboptimization and isolation [36], [37]. In the instance of sub-optimization attacks, the attackers strive to 
degrade network efficiency by failing to generate the optimal pathways. Selective Forwarding attack, sinkhole 
attack, neighbour attack, wormhole attack, routing information reply attack, and worst parent attack are all 
currently undergoing sub optimization [38]. Additionally, topology attacks enable the isolation of a node or a 
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group of nodes, preventing it from contacting to their parents or the root. In the sub-optimization attack 
category, attackers attempt to degrade network efficiency by failing to generate optimum pathways. 


RPL ATTACKS 


RESOURCES 


TRAFFIC 


h if ) f ( 
! DIRECT ATTACKS INDIRECT ATTACKS SUB OPTIMIZATION | ISOLATION EAVESDROPING MISAPROPPTIATION 
, \ Se 
INCREASED RANK ’ DAO | 
ATTACK | SINKHOLE INCONSISTENCY SNIFFING ] IDENTITY ATTACK 
ROUTING TABLE DAG | (F ) 
IN i DECREASED RANK 
OVERLOAD INCONSISTENCY WORMHOLE BLACKHOLE TRAFIC ANALYSIS ATTACK 
ey 7 \ A 
_———EE a 
VERSION NUMBER WORST PARENT 
MODIFICATION 
SSS 


R1 REPLAY 
——— 


a 


ROUTING TABLE 
FALSIFICATION 


Figure 2. RPL attacks in loT 


2.5. Blackhole attack 

Blackhole attacks carry out malicious actions such as creating a high rate of packet loss, packet 
overhead and depleting the IoT nodes' limited resources [13]. The stability of RPL network will be affected 
due to changes of node ranks and increase of network latency due to blackhole attack by the malicious node. 
Furthermore, the nodes' rankings are recalculated as a result of the rank change. The rank change triggers RPL's 
self-healing method for removing local routing loops. When the frequency of blackhole assaults rises, the local 
repair turn to ineffective, forcing DODAG root to initiate global repair. RPL network become unstable due to 
frequent change by the repair message [39]. Due to the protocol's dynamic nature by listening for manipulating 
request packets by an attacker. This is performed by sending back forged trafic with information about the 
destination’s shortest path. As a result, a link is formed among the source node and blackhole node. In general 
the blackhole node controls every packet on that path [18]. Due to blackhole attack, retransimision rate is 
increase by child node and lead to DoS attack [40]. 

A blackhole assault or attack occurs when a hostile node secretly drops all packets that it is intended 
to send [8], [41]. It can result in severe traffic loss, loss of resource energy, and even end-to-end packet delay 
problems in a RPL network [42]. Each RPL node has an vertical default route point at root that includes list of 
prefered parents [43]. If a node start to send message to BR, the message is first sent through the node's parent. 
A rogue node presents itself as the best path throughout this procedure [44]. Nodes choose the rouge node as 
their preferred parent and begin forwarding data packets to it; the rogue node then exclude any data packets 
intended for the root in a discrete manner. This is called as single blackhole assault or attack. 

Blackhole assault's primary purpose is to launch an internal denial of service attack against the child 
nodes by removing any information received from the other nodes. A malicious node that launches this attack 
is like a blackhole that absorbs everything and it also does not generate messages [45]. This behaviour, if done 
at the correct time and place will isolate other nodes in the downward route from the attacker node from the 
rest of the network [19]. It is worth noting that a node rank change in RPL routing indicates a calculation and 
arrangement of a child-node to new parent. A malicious node promoting themselves to nearest nodes as shortest 
routes with an apperance to influence other nodes in RPL while dropping the packets [39]. This fake routing 
table information reduces the authenticity of routing information in networks, affecting system efficiency and 
overall performance [46]. There are two sorts of blackhole assaults: single and colluding blackhole attacks 
which is have shown a great impact on IoT network topology [47], [48]. 
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3. DISCUSSION 

IoT is a rapidly growing area of research that linked the data analytics capabilities to strong 
merchandise, industrial, utility parts, and sensors over the Internet. To reform day-to-day work, play, and life, 
the IoT tries in creating a connected intelligent world. IoT gadgets incorporate various objects through the 
association of applications alongside remote empowering technologies [49]. Small sensor nodes are utilised to 
power batteries, compute, and solve equations. These devices are incapable of being encrypted using normal 
encryption techniques. Due to the tools’ inherent nature and dependency on wireless media, they are liable to 
a number of attacks, for instance the blackhole attack. By accessing the network, hackers may simply attack 
these nodes. An advance research has been done as such far, yet more proficient work will be expected to 
forestall sensor networks from such attacks [13]. 

For instance, an intrusion detection named SVELTE [50] that concentrated on routing risks such as 
sinkholes, selective forwarding, and data that has been altered or fabricated has been suggested. SVELTE 
utilises end-to-end message security methods such as and datagram transport layer security and internet 
protocol (IP) Security. It adopts a hybrid, centralised and distributed method, with modules located in both 
border router and resource-constrained nodes. It is made up of three fundamental components, i.e., entry 
module, intrusion detection module and mini firewall module. 6LoWPAN mapper (6Mapper), collect and 
reconstructs data on the RPL network in the border router [50]. The intrusion detection module investigates 
the planned data and identifies intrusion. The mini firewall is expected to free nodes stress by separating 
undesired traffic before it enters the resource-constrained network. However, the results shows that a number 
of normal nodes was mistakenly identified as an attacking node which led to a high false alarm rate [51]. 

Ahmed and Ko [14], it takes a different strategy, identifying questionable nodes by studying the 
activity of neighbouring nodes to verify the suspected node is indeed a blackhole. Single and colluding 
blackhole attacks are mitigated by boosting the rate of malicious node detection and its associated packet 
delivery rate (PDR). The approach is composed of two steps. The first step refers to global verification process 
where a local decision made by a node that watches the behaviour of its neighbours. If a rogue node is detected, 
decision on whether it is a blackhole node or not is decided by the root. This strategy is claimed to be highly 
successful. However, when each node monitors the behaviour of its neighbours, the volume of memory 
overflow increased in these constrained devices. Moreover, since the root node is the one making the final 
decision, possibility of single point of failures will increase (if compromised) [14]. This is crucial since majority 
of the IoT devices have memory and processor limitations. Memory and processing power are scarce resources 
that are used to store routing information and queue data packets for transmission. 

Djedjig et al. [52] is using a modified objective function dubbed the trust objective function. They 
create a seperate hardware chip, named trusted platform module (TPM) which stores the MRTS or Metric- 
based RPL trustworthiness scheme used to calculate trust values. Additionally, the data are utilised to determine 
the presence of blackhole nodes. This approach demonstrates how to secure RPL networks regardless of the 
services supplied by trusted devices [52]. MRTS is a cooperative mechanism that enforce RPL node estimates 
information of its nearby nodes using both direct and indirect suggestions. One downside of MRTS is that it 
determines the ideal path for traffic routing only based on node metrics. If nodes are not self-centered, the 
fundamental standard for determining the parent will be energy. As a result, certain nodes near the chosen 
trustworthy path will use high usage of energy than others, that lead tp an unequal distribution of energy 
consumption. Additionally, because MRTS disregards connection data, it degrades packet delivery ratio. The 
researchers proposed many methods for determining the dependability of a route, including the projected 
number of retransmissions (ETX), the link quality level (LQL) and received signal strength (RSS). 

Based on RPL network, [39] has established a trust value on IoT node which used to quantify trust 
while include determined trust values for routing purpose. This combines the required information to make the 
best routing choice while exclude rogue nodes. Additionally, this value determines the effective feedback based 
on the following two assumptions; i) a node runs in a promiscuous mode, letting it to listen in on the 
transmissions of neighbouring packets and ii) because each blackhole attacking node would eventually discard 
all route packets, successful feedback between nodes will necessarily reflect any node's blackhole character. 
To increase the RPL's isolation from blackhole attacks, the trust-based method is merged into a new protocol. 

However, in this approach, the detection and verification processes will involve nodes in the RPL 
network [39]. Additionally, each node’s energy level is not measured in this investigation. Strainer-based 
intrusion detection of blackholes in 6LoWPAN for the internet of things (SIEWE) created in [5], demonstrated 
a simple method for detecting and mitigating single blackholes. The suggested technique begins by 
constructing a list of suspects depending on behavior of nodes and network operation, suspicious node are 
confirmed by referring to their neighbouring nodes’ behaviour. The last phase, the BR node will take care of 
the malicious node's global omission. To remove the node from the network, the strategy applies a blacklist 
mechanism. It is divided into two modules: a local one installed on each node and a global one deployed on 
each border router (BR). The conventional RPL protocol is compared to a suggested method that utilises the 
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PDR statistic in the research. The PDR value is the ratio of packets produced by network sensor nodes to 
packets received by the BR. 

A paper proposing a root-based protection to protect from blackhole attacks [53]. It distinguishes 
malicious node by introducing a bundle misfortune identification method on the root node, which distributes 
data about the suspected node to the entire network. This method assessing the typical bundle misfortune rate, 
it mitigates misleading cautions then non-root node segregate malicious node by using their insight about 
blackhole node [53]. The proposed technique was found to have a prompt detection and isolation of a blackhole 
nodes with incurring a minimal energy cost. According to the research, this is one of the rare works in Cooja 
that incorporates blackhole assaults and their defensive tactics, as well as energy analysis [54]. Further 
developed defense arrangements, for example, identifying malicious nodes by dissecting their set of history, 
might be important to further develop framework execution. The research provides a detail security solution to 
solve blackhole issue [53]. 

In a study [55] introduced a novel detection approach for blackhole and greyhole assaults based on an 
existing lightweitgh heartbeat protocol (LHP). The approach provided clearly comprises of two parts: 
i) detection stage: during the discovery process, it is positioned at the root node and network node’s IP and 
ii) detection stage: every k seconds, the detection phase is started, looking for a probable blackhole assault by 
referring the counter to a predetermined threshold. The counter will be reset if a node is defined as malicious. 
It will resend UDP queries to each node. 

CPU and memory use, as well as transmission and reception rates (TX and RX) are used to evaluate 
detection approaches [55]. This experiment demonstrated an increase in all factors mentioned. Table 2 
summarises the preceding discussion. 


Table 2. Blackhole attack detection 


Source Country Objectives Experimental Limitation Performance 
Setup Measures 
Raza et al. Sweden SVELTE: Real-time intrusi« Contiki’s 1. Placement of IDS in network 1. Overhead at 
[50] detection in the Internet of — network 2. Timing irregularity in rank node-level and 
Things simulator estimations network level 
Cooja 3. Incorrect topology creation at 2. Detection rate 
6BR 3. Power 
4. High false positive rate Consumption 
(FPR). 
Ahmed Korea Mitigation technique Contiki’s 1. Single & colluding blackhole _1.False Positive 
and Ko based on neighbourhood network detection Rate 
[14] node behaviour simulator 2. Each node notices the way of 2.True Positive 
Cooja behaving of its neighbors which _ Rate 
builds the memory over-burden 3.Packet Delivery 
in these compelled devices Rate 
4.End to End 
Delay 
Djedjig et Algeria Metric-based RPL Contiki’s 1. Add on Trusted Platform 1. Average Packet 
al. [52] Trustworthiness Scheme network Module chip Delivery Ratio 
(MRTS) simulator 2. Additional expense for IoT 2. Average 
Cooja network and perhaps infeasible Throughput 
for some IoT applications. 
Airehrour New Trust-based mechanism Contiki’s 1. Implementation it will 1. Average 
et al. [39] Zealand network involve every node for detection Throuhput 
simulator and verification process 2. Packet Loss Rate 
Cooja 2. Uses only packet forwarding 
value 
to calculate trust. 
Patel and India SIEWE (Strainer Contiki’s 1.Single blackhole detection 1. Packet Delivery 
Jiwala [5] based Intrusion Detection network Ratio (PDR) metric 
of Blackhole in simulator 
6LoWPAN for the Cooja 
Internet of Things) 
Jiang et al. United Root-based Defence Contiki’s 1. Single blackhole detection 1. Packet Loss 
[53] State of Mechanism Against RPL network Rate 
America Blackhole Attacks simulator 2.Energy 
Cooja Compsution 
3. Network 
Throughput 
Ribera et United Heartbeat-Based Contiki’s 1. Single blackhole detection 1. Transnmission 
al. [55] Kingdom Detection network only Rate 
simulator 2. Increase in CPU usage, 2. Receiption Rate 
Cooja memory usage, TX and RX 
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4. CONCLUSION 

6LoWPAN empowers devices with serious asset imperatives to interface with IPv6 organizations. To 
control the whole organization, RPL makes an upgraded destination-centered guided acyclic graph (DODAG) 
in view of the border router (BR). Blackhole attack or assault is defined as denial of service attacks within RPL 
network. An active area of DODAG, the attacker attempts to become a parent and draws a larger traffic to it 
and absorbs all the traffic and packets. The blackhole attack avoids the receipt of packets at BR. Blackhole 
attack influences the network's packet distribution ratio and ultimately compromises the overall network's 
reliability. The attack prevents packets from being received at the BR, degrades the network's packet 
distribution ratio, and eventually jeopardises the network's reliability. Blackhole attack known as single 
blackhole attack happens when an attacker node acts as a single node. When one attacker node work together 
with another malicious node to misguide the remaining nodes more efficiently, this is described as a colluding 
blackhole attack. Based on study on blackhole detection method, there is limitation in the technique for example 
false positive rate (FPR), increase of processing power bandwidth consumption and memory usage. There is 
also lack of detection methods related to colluding blackhole attack. To conclude, a blackhole attack in RPL 
network is a kind of denial of service attack, which is very difficult to detect and defend. When a and such 
blackhole attack happens, the entire performance of the network will be affected. The situation can be worst if 
multiple or colluding blackhole attacker nodes are present in the RPL network. This requires further study on 
blackhole detection that can detect single and and colluding blackhole in RPL networks. 
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